(a) PITs should be used to verify that equipment does not exhibit permanent upset or damage when subject to the pin-injected transient waveforms. During these tests, the transient waveforms are applied directly to the designated pins on the equipment connector, normally between each pin and the equipment chassis ground, as described in Section 22 of RTCA Document DO-160. This method assesses the dielectric withstand voltage or damage tolerance of the equipment interface circuit. For equipment electrical interface circuits that are electrically isolated from the equipment chassis or grounds, the applicant can perform a dielectric withstand or high-potential (hi-pot) test that meets or exceeds the peak transient waveform voltage amplitude in place of the PIT.
(b) Equipment interface circuits with low impedance with respect to the equipment chassis should be subjected to the PIT. For pin injection purposes, low impedance should be considered less than 100 ohms at any frequency below 10 KHZ. Shunt filters and transient suppression devices such as Tranzorbs(tm) normally produce low impedance to chassis to provide transient protection and should be subjected to the PITs at the selected waveform levels.
(4) Aircraft and Engine Certification Lightning Tests.
(a) For engine-mounted EECs, lightning tests conducted on an EEC system may be adequate to cover aircraft certification, as well as engine certification, provided the aircraftengine interface cables and current levels are adequately represented in the test. The test levels should be at a level compatible with the installation. The applicant and the ECO should mutually agree on the test level in the test plan. To account for the aircraft contribution to the test levels, the applicant should coordinate with the ACO to determine a mutually acceptable test level for the category of aircraft involved.
(b) The engine manufacturer should note that each aircraft manufacturer installing an engine must determine the levels to which the installed engine and EEC system will be exposed for the particular aircraft. The aircraft manufacturer should demonstrate that these levels are equal to or less than the levels used for engine certification testing. If the aircraft manufacturer cannot demonstrate this, then EEC system lightning tests may be needed to show compliance with aircraft certification standards.
e. Maintenance Requirements. Section 33.4 and Appendix A to part 33 require that the engine manufacturer prepare ICA for all engine parts. A maintenance plan must be part of the ICA. Therefore, as part of the environmental protection system that is part of the engine type design and is used to protect the EEC system from HIRF and lightning, a maintenance plan must be provided to ensure the continued airworthiness of the installed systems. Notice 8110.71 provides some guidance that can be used to meet the ICA requirement. Maintenance requirements may include periodic inspections or tests for required structural shielding, wire shields, connectors, and equipment protection components. The applicant should provide the engineering validation and substantiation of these maintenance requirements.
Page 7-4 Par 7-3.d.
f. Environmental Testing. All components of the EEC system, including all electronics units, sensors, harnesses, hydromechanical elements, and any other relevant elements or units, should be tested to establish that they will operate properly in their declared environment. When applicable, tests defined in RTCA Document DO-160D have been accepted. Environmental test plans should be approved by the ECO before the tests are conducted.
(1) Although environmental test limits are not specified in this AC, environmental tests should be representative of the environments that are expected to be encountered in the engine installation. Special attention should be given to any condition that could affect more than one engine or propeller control system, such as a faulty operation during hot day ambient conditions.
The environment for which the component is qualified should be entered into the instruction manual and is considered an installation limitation for the installer.
(2) The applicant should prepare an environmental test plan summarized in an environmental test matrix that defines the method to be used to qualify the component for each of the environments. The environments and test procedures defined in RTCA Document DO 160D have been acceptable to the FAA for electrical and electronic components. Generally, only the environments that are expected to be encountered should be tested. The matrix can note other environments as “not applicable.” The components should be qualified by test, similarity, analysis, or any combination of these.
(3) The applicant should provide the proposed test plan for approval before conducting tests of fuel handling, hydraulic, and pneumatic components, such as the fuel metering unit (FMU) and actuators. These components should be qualified by test, similarity, analysis or any combination of these. In some cases, the testing required for the engine block tests under §§33.49 or 33.87 may be adequate to qualify these components. Otherwise, additional tests are required under §§33.28(d) and 33.91(a).
(4) The explosion proof testing verifies that a component cannot cause an explosion of flammable fluids or vapors. If applicable, explosion proof testing may be performed as defined in Section 9 of RTCA DO-160. Section 9 of DO-160D applies to demonstrating compliance with §§33.28 and 33.91. DO-160D defines Environment I as equipment mounted in fuel tanks or within fuel systems and Environment II as an atmosphere in which flammable mixtures can be expected to occur as the result of a “fault causing spillage or leakage.” These definitions for the equipment environment may not be in complete agreement with definitions for aircraft engine installations.
(a) For installations in designated fire zones as defined in §§23.1181, 25.1181, 27.1181, and 29.1181, the fire zone should have extinguishing provisions so that the explosion proof test given by Section 9 of Environment II of DO-160D would be adequate. However, flammable fluid leakage areas as defined in §25.863 and other sections may not have fire extinguishing provisions or any of the other safety requirements associated with fire zones, due to the assumption that there are no ignition sources in those areas. In these cases, the applicant should be aware that the explosion proof test given by Section 9 of Environment I of DO-160D, Par 7-3.f. Page 7-5
although not a requirement for engine certification, might be a requirement for aircraft installation. The applicant may also demonstrate by test or analysis that the EEC system is not an ignition source.
(b) The applicant should state the type of explosion proof test that has been conducted in the installation instructions. In addition, if the applicant anticipates installations in a zone where flammable fluid requirements may be imposed, the test or analysis that demonstrates that the EEC system is not an ignition source should be referenced or included in the installation instructions.
g. Time Limited Dispatch (TLD) Environmental Tests. Although TLD is not a requirement for certification, HIRF and lightning tests for TLD should be conducted with the tests conducted for certification. To get approval for the use of TLD, applicants should demonstrate that dispatchable EEC configurations continue to meet the environmental requirements of the certification basis. SAE Document ARP 5107 contains applicable TLD information. For HIRF and lightning, applicants have usually determined that the single channel dispatch configuration is the worst case dispatch configuration; they have conducted HIRF and lightning tests with one channel inoperative to demonstrate compliance. For other environments, the applicants have complied by analysis and statements of compliance.
Page 7-6 Par 7-3.f.
CHAPTER 8. SECTION 33.28(e)
8-1. Rule Text. Section 33.28(e) provides that each EEC must: “Have all associated software designed and implemented to prevent errors that would result in an unacceptable loss of power or thrust, or other unsafe condition, and have the method used to design and implement the software approved by the Administrator.”
8-2. Intent of Rule. Section 33.28(e) requires that electrical and electronic engine control systems have all associated software designed and implemented to prevent errors that would result in a unacceptable loss of power or thrust, or other unsafe condition, and have the method used to design and implement the software approved for the application.
8-3. Compliance with §33.28(e). The following guidance provides a method, but not the only method, of compliance with §33.28(e).
a. Software Level Requirements. Software should be designed and implemented according to the standards established as Level 1 or Level A, as provided in RTCA documents DO-178A and DO-178B, respectively; the applicant should complete any additional testing required by the Administrator. RTCA Document DO-178A has been superseded by RTCA Document DO 178B; engine certification projects with a date of application after January 11, 1993, should use RTCA Document DO-178B. Part 23 applications not intended to be certificated to part 25 requirements should use the standards of DO-178B level B or C for the control. The applicant should coordinate this with the airframe manufacturer and the ACO early in the certification program.
b. Software Partitioning. It may be possible to partition non-critical software from the critical software to allow the non-critical software to be designed and implemented at a lower level than that established in the RTCA documents. Applicants should substantiate the adequacy of the partitioning method and should consider if the lower levels of the partitioned software are appropriate for the anticipated installations. If the criticality level requirement were higher in subsequent applications, it would be difficult to raise the software level without repeating the software life cycle processes for the new level.
c. Software Integrity. RTCA Document DO-178B provides guidance for software used at specified hazard levels. As with all guidance in this document, this may be modified due to future events or advancements in technology.
d. Programmed Logic Devices. Due to the nature and complexity of systems containing digital logic, programmed logic devices should be developed using a structured development approach, equivalent to the hazard associated with failure or malfunction of the system in which the device is contained. Programmed logic devices include application specific integrated circuits (ASIC) and programmable logic devices (PLDs). An ASIC is defined as any masked programmed integrated circuit that requires physical customization of the device die by an ASIC Par 8-1 Page 8-1
vendor. Gate array, cell-based and custom designs are included, as they involve some level of customization of the mask sets used in the fabrication of the devices. A PLD is defined as any device that is purchased as an electronic part and altered to perform an application specific function. PLDs usually require programming by the equipment manufacturer.
(1) PLDs include, but are not limited to, the following:
(a) Programmable array logic (PAL) devices;
(b) Programmable logic array (PLA ) devices;
(c) General array logic (GAL) devices;
(d) Field programmable gate array (FPGA) devices; and
(e) Electrically or erasable programmable logic devices (EPLD).
(2) RTCA Document DO-254 provides guidance for the criticality, failure condition categories, and design assurance levels associated with development of programmed logic devices. This is an acceptable means, but not the only means, for demonstrating compliance with §33.28(e).
(3) For off-the-shelf equipment or modified equipment, service experience may be used to demonstrate compliance. This should be acceptable if the worst case failure or malfunction of the device for the new installation is not more severe than that for the original installation of the same equipment on another application. The applicant should also consider significant differences related to the environmental or operational category of the aircraft in which the original system was installed and certified.
Page 8-2 Par 8-3
Appendix 1 APPENDIX 1. REGULATORY BASIS FOR REQUIRING
AN EEC SSA AND LOTC ANALYSIS UNDER §33.28
1. This appendix explains the basis for requiring an SSA as part of an applicant’s demonstration of compliance with §33.28. Before §33.28 was added to part 33, EEC systems were certified only upon demonstration of complete redundancy in the electronic portions of critical loops of the system. Applicants that did not perform an SSA were required to demonstrate sufficient similarity to earlier EEC accepted designs that had adequate redundancy. Section 33.28 codified for general applicability the practices used in these early EEC engine certification programs. If changes in EEC design make it no longer possible to accept EECs based on similarity with earlier accepted designs, then future applicants must, in order to demonstrate compliance with §33.28, submit an SSA for each EEC design.
2. The FAA will accept new technologies on the basis that the safety and reliability of that new technology are equivalent to, or an improvement over, current technologies. On this basis the EECs were accepted in place of HMC designs after establishing the basis for comparison as one LOTC event per 100,000 hours of service. An LOTC event is one in which there is a loss of the ability to control engine thrust from flight idle to 90 percent of maximum rated thrust. This basis for comparison was established after extensive review, by FAA and industry, of in-service reliability data of existing engine control systems. The results of that review were documented in issue papers and technical memoranda.
3. To meet this reliability standard, early EEC systems were designed with dual channel redundancy from the sensed inputs to the dual output devices for the critical control loops, defined as the fuel, stator vanes, and bleed control loops. Parts of the engine control system that remained with HMC technology generally were not made redundant.
4. A means, but not the only means, of compliance with §33.28 is provided in this AC through analysis that demonstrates that the proposed EEC system meets the LOTC criteria and that the EEC system has adequate redundancy and fault accommodation.
5. Section 33.28 provides that “no single failure or malfunction or probable combination of failures of electrical or electronic components of the control system, results in an unsafe condition.” The term unsafe condition as used in this context is not limited to those specific conditions described in §33.75. While changes in thrust alone, however, will not always constitute an unsafe condition, the FAA will continue to evaluate unwanted changes in thrust or power with regard to the frequency of those events, their magnitude, and their occurrence in the flight envelope in determining whether an LOTC constitutes an unsafe condition for a particular engine design. New technology electrical and electronic EEC systems introduce potential failures that could result in unsafe conditions requiring an SSA under §33.28. Those failures include, but are not limited to, the following:
a. Complete loss of control over the engine.
b. Instability in the control of a critical function of the engine.
Appendix 1
c. Unwanted change in magnitude or direction of power or thrust in some operating conditions.
d. Unwanted action of a critical control function, such as the uncommanded deployment of thrust reversers.
6. Early EEC system designs have full redundancy on electronic parts of the system that control critical loops and, therefore, were found to provide reliability equivalent to the HMC systems they replaced based on the established reliability criteria of one LOTC event in 100,000 hours of service. These systems are essentially single fault tolerant. They cannot be considered fully single fault tolerant because a small percentage of failure types either cannot be addressed or are not detectable and as such cannot be accommodated. Using this criteria, subsequent systems can be accepted based on their similarity in design with these early redundant EEC systems. In recent certification programs, however, applicants have proposed engine designs using EEC systems that offer less than full redundancy. In these newer EEC designs significant unwanted changes in thrust or power could occur as a result of single system failures. Therefore, since these newer systems were not similar in design and did not meet the LOTC reliability criteria equivalent to HMC systems, the FAA could not accept these systems without an SSA to demonstrate compliance with §33.28.
7. The FAA has recognized that a uniform method for demonstrating how newer EEC systems comply with §33.28 would both promote safety in air commerce and aid industry. This AC provides that method based on meeting the LOTC reliability criteria for HMC designs through tests, analysis, or both. The FAA also recognizes that the LOTC reliability criteria for HMC designs was established through review of service experience data for aircraft certified under part 25 only, and an acceptable reliability criteria for aircraft certified under other standards (parts 23, 27 or 29) may differ from the part 25 criteria. Applicants are cautioned, however, that engines certified under part 33 are generally not restricted to a specific operational use. Therefore, the FAA may have to apply the more conservative part 25 criteria in a particular certification program if it determines that the engine involved in that program may be eligible for installation on an aircraft that may be certified under part 25.